[TikiWiki-commits] [Git][tikiwiki/tiki][28.x] [ENH] smarty security pref to whitelist some built-in PHP functions to be used...

Victor Emanouilov pushed to branch 28.x at Tiki Wiki CMS Groupware / Tiki


Commits:
3dd3efb3 by Victor Emanouilov at 2025-12-08T11:15:09+02:00
[ENH] smarty security pref to whitelist some built-in PHP functions to be used as modifiers/functions in templates

- - - - -


4 changed files:

- lib/init/smarty.php
- lib/prefs/smarty.php
- lib/smarty_tiki/Extension/SmartyTikiExtension.php
- templates/admin/include_security.tpl


Changes:

=====================================
lib/init/smarty.php
=====================================
@@ -125,6 +125,16 @@ class Tiki_Security_Policy extends \Smarty\Security
         $this->secure_dir = array_merge($this->secure_dir, $dirs);
     }
 
+    public function isTrustedModifier($modifier_name, $compiler)
+    {
+        $allowed_builtin_php_functions = array_filter(TikiLib::lib('tiki')->get_preference('smarty_security_allowed_builtin_php_functions', [], true));
+        if (in_array($modifier_name, $allowed_builtin_php_functions)) {
+            return true;
+        }
+
+        return parent::isTrustedModifier($modifier_name, $compiler);
+    }
+
     /**
      * Work around a bug in smarty where _updateResourceDir doesn't clear the values correctly when
      * smarty templateDir has been updated


=====================================
lib/prefs/smarty.php
=====================================
@@ -78,6 +78,19 @@ function prefs_smarty_list()
                 'smarty_security',
             ],
         ],
+        'smarty_security_allowed_builtin_php_functions' => [
+            'name' => tr('Allowed Smarty built-in PHP functions'),
+            'description' => tr("This is the list of allowed built-in PHP functions to be used as smarty modifiers. Smarty 5+ disabled the use of PHP functions as smarty modifiers. Use this preference to allow specific built-in functions not available in the currently exposed modifiers list that you need to use in your templates."),
+            'warning' => tr('There may be security implications. Make sure you know what you are doing. Try to keep this list as short as possible.'),
+            'hint' => tr('Use "," to separate values'),
+            'type' => 'text',
+            'separator' => ',',
+            'perspective' => false,
+            'default' => '',
+            'dependencies' => [
+                'smarty_security',
+            ],
+        ],
         'smarty_security_dirs' => [
             'name' => tr('Extra Smarty directories'),
             'description' => tr('Make additional directories available as Smarty directories. This may be needed for custom icons (clear temp/cache after changing).'),


=====================================
lib/smarty_tiki/Extension/SmartyTikiExtension.php
=====================================
@@ -47,6 +47,13 @@ class SmartyTikiExtension extends \Smarty\Extension\Base
 
     public function getModifierCallback(string $modifierName)
     {
+        $allowed_builtin_php_functions = array_filter(TikiLib::lib('tiki')->get_preference('smarty_security_allowed_builtin_php_functions', [], true));
+        if (in_array($modifierName, $allowed_builtin_php_functions) && is_callable($modifierName)) {
+            return function(...$args) use ($modifierName) {
+                return call_user_func_array($modifierName, $args);
+            };
+        }
+
         switch ($modifierName) {
             case 'a_or_an':
                 return [new \SmartyTiki\Modifier\AorAn(), 'handle'];


=====================================
templates/admin/include_security.tpl
=====================================
@@ -59,6 +59,7 @@
                     {preference name=smarty_security_disabled_tags}
                     {preference name=smarty_security_allowed_modifiers}
                     {preference name=smarty_security_disabled_modifiers}
+                    {preference name=smarty_security_allowed_builtin_php_functions}
                     {preference name=smarty_security_dirs}
                 </div>
                 {preference name=feature_purifier}



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/3dd3efb3b97b90fb8ece3deb86e0378dec080722

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/3dd3efb3b97b90fb8ece3deb86e0378dec080722
You're receiving this email because of your account on gitlab.com.

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs